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AMENDMENTS TO THE SPECIFICATION 
Please amend the paragraph beginning on page 21, line 4 as follows: 

Figs. 13 Aand 13B is a flowchart of the high level steps performed by the 
controller 1400 during food product sterilization. 

Please amend the paragraph beginning on page 61, line 14 as follows: 

Figs. 13 A and 13B is a flowchart of the high level steps performed by the 
controller 1400 during food product sterilization, and in particular for determining 
whether a change to the food sterilization process can be safely performed. Prior to 
startup of the sterilizer 181, in step 1802, the safety controller 1436 identifies the 
components of the sterilizer that are required to be appropriately operable for safe 
operation of the sterilizer. Such identification may take place in two substeps: (1) 
identify the components that must be operable regardless of the food product being 
sterilized (e.g., the motor 173, various ones of sensors in Fig. 12, and the emergency 
button 1406), and (2) the components that must be sufficiently operable for the sterilizer 
181 to operate safely, and to output a properly sterilized food product (e.g., a sufficient 
number of emitters 161 must be functional to obtain the desired UVC irradiance for the 
food product 115 that is to be sterilized). Since some embodiments of the surface 
sterilizer 181 may not include all of components shown in Fig. 12, the safety controller 
1436 may access a sterilizer configuration data file from, e.g., the food product settings 
database 1422 for identifying the required components of the surface sterilizer 181 that 
must be operable for the safety controller 1436 to determine that the sterilizer can be 
operated. Once such components have been identified, step 1804 is performed, wherein a 
determination is made as to whether the safety controller 1436 has determined that it is 
safe activate, reactivate and/or reconfigure all of the identified components of the surface 
sterilizer 181. Note that such components may be not currently active, or alternatively 
may be in an undesirable state and thus must be reconfigured. Subsequently, for each of 
the identified operable components, the safety controller 1436 may access a runtime data 
storage of descriptor (or "object" in object-oriented terminology) for determining: 

(a) whether the component is currently active, available to be activated, or 
partially (or wholly) inoperable, and 
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(b) for each component that is identified as not currently active and is not 

identified as inoperable, the safety controller may query the component for 
its operational status, and/or the controller 1436 may test the component to 
determine its operational status and the operational status of any 
associated sensors. 
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